What you can check about a link before opening

A URL begins with a scheme, and its authority part has the shape userinfo@host:port, where the userinfo and port are optional ¹. The part that decides where a click goes is the host, which sits after any userinfo. The same standard warns that because userinfo is rarely used and appears before the host, it can be used to build a link meant to mislead a person: the text before the @ can look like a trusted hostname while the real host is something else ¹.

• Scheme: only http and https links are worth checking as web links. Anything else is a different kind of action.
• Userinfo: a name@ before the host is a reason to look twice.
• Host: read it right to left. The registered domain is the last two or three labels, not the first words.

A short link or a tracking link usually answers with a redirect rather than a page. HTTP defines a family of redirect responses: 301 says the target resource has been assigned a new permanent URI, and 302 says it resides temporarily under a different URI ². The new address arrives in a Location header, so the page you land on can be on a different domain from the link you were sent.

Following a chain means making requests to each hop, which is an active step, so we do not do it in the link-safety product. If you need to follow redirects, do it in a sandbox with a request limit, and run the host of every hop through a check.

Two lookups need no visit to the page. The first is the domain's registration record: RDAP returns events such as registration (the object was initially registered) and expiration ³. A domain registered a few days ago deserves more caution than one that has existed for years; the domain age product runs that check.

The second is a list of domains that have already been reported as malicious. The CERT Polska Warning List is one: a continuously updated list of dangerous websites, aimed at phishing domains, maintained by CERT Polska, which is part of NASK ⁴. Domains stay on it for six months, the list may be used for any purpose including commercial use, and attribution is not required ⁴.

The link-safety product takes a URL, requires it to be http or https, and checks its host and parent domains against one source: the CERT Polska Warning List. It matches at domain level, so the path is not examined, and it does not fetch the page or follow redirects. The response reports a listed or not_listed verdict, which feeds were checked with their data date and licence, and any feed that could not be read.

A not_listed result is not a safety rating. The list holds only domains that have already been reported, and a listed domain can be a compromised site that is now clean. Treat the result as one signal next to the checks above.

1curl -X POST https://YOUR_API_HOST/v1/link-safety \
2  -H "Authorization: Bearer $LOOKVALID_API_KEY" \
3  -H "Content-Type: application/json" \
4  -d '{"url":"https://example.com"}'

1{
2  "host": "example.com",
3  "verdict": "not_listed",
4  "matches": [],
5  "feeds_checked": [
6    { "id": "cert-pl-warning-list", "name": "CERT Polska Warning List of malicious domains", "matched": false }
7  ],
8  "feeds_unavailable": []
9}

1. Parse the URL and reject any scheme other than http or https.
2. Flag userinfo before the host.
3. Send the URL to the link-safety check and branch on verdict.
4. Check the registration age of the host and hold young domains for review.
5. Open anything that is still unclear only in an isolated browser.

You can try the check without a key in the free link safety tool, then wire the same lookup into your own flow from the link safety product page.